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ACRGCG is an association of individuals dedicated to providing better access to care 
records for adult care leavers, working with adult care leavers and organisations to lobby 
government for changes in law and regulation. 

We welcome this draft guidance and consider that it sets out clearly the rights of 
individuals to know what personal data is held by an organisation about them and the 
responsibilities on organisations to respond to a request to see that data. It establishes 
both clear principles, explanations of the legal requirements and the need for systems to 
both secure personal data and ensure its retrieval. We read it has having an ‘enabling’ 
approach to sharing information held on records, which is encouraging. We agree with 
MIRRA submission that the focus of the guidance is on process and procedure which is 
important but does not address the impact on an adult care leaver if the response to their 
SAR is thoughtless and unsupportive at best or the exercise of discretion to provide thrid 
party information is defensive and unnecessarily redactive. 


We understand that the guidance is in general terms and that the ICO is not at this time 
issuing sector specific guidance. We share the view of MIRRA that it would be helpful to 
have supplementary guidance regarding releasing personal data held on social care 
record, placing the adult care leaver at the centre of decision making and the balancing of 
privacy rights of others. 


One of the significant barriers that adult care leavers face when making a SAR to find out 
about themselves and their personal and family history which the organisation holds in the 
individual’s care records is the reality that the response from the Data Controller is to treat 
the request as a standard SAR and to approach the task very narrowly. Our Freedom of 
Information survey to local authorities in England in 2017 demonstrated that of those that 
responded three fifths had no records of the number of Subject Access Requests [SARs] 
made in a 12 month period by adult care leavers. Most local authorities did not keep data 
about the number of SARs from care leavers in an annual period and appeared to have no 
dedicated process and systems in place to respond to such a request. The needs of adult 
care leavers are unique and, in our view, the Data Protection Act 2018 is not designed to 
address their right to know what personal information and relevant family information is 
held about them on care records. The issues that these people face include: 


e defensive redaction of information particularly third-party information, often 
information which is already known to them 
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e defensive exercises of what should be an enabling discretion to provide third party 
information — both in the decision making about whether to get consent from the 
third party and about sharing third party information without consent 


e failure to understand what information on care records Is not ‘protected’ information 


e an overuse of the ‘serious harm’ test to withhold information, sometimes not 
properly informed by professional health advice about the individual’s current health 
and circumstances. And as MIRRA points out, based on their research with adult 
care leavers, the more serious harm is the impact of withholding information on the 
emotional well — being of the person making the request. 


e lack of sensitivity about explaining language, terms or professional jargon used in 
documents in their case file: this is particularly so for older adult carer leavers who 
are distressed by terms and descriptions about them and their family that were used 
in the past 


e lack of support to the individual during the SAR process and after their care records 
have been shared. 


The guidance is targetted to DPOs. [p3] We ask that the ICO makes this guidance known 
widely beyond the usual data governance remit. Preparation of responses to SARs from 
adult care leavers made to a local authority or sometimes in the voluntary sector is often 
done by a social worker or an administrative officer who has limited knowledge of an 
individual’s personal data rights. It would be useful to inform Directors of Children’s 
Services as well as data governance officers of this guidance. It is for this reason that we 
also believe that sector specific guidance issued under the authority of the ICO would 
significantly improve both decision making and practice. 


Below we comment on what is welcome and where we consider there are limitations or 
omissions in the current draft. We hope this is an acceptable way forward rather than 
using the standard consultation form. We welcome this guidance and its enabling tone: we 
believe that supplementary guidance would address the unique rights and needs of adult 
care leavers and reduce the ‘unfairness’ of the present practice and decision making. 


Page number Comment 


3- We welcome the clear statement that a SAR is a ‘fundamental right’, 
supplementary together with the clear statement regarding supplementary information. 
information For older care leavers, the records may not be clear about with whom 


their Personal Data has been shared and it would be useful if it was 
stated that the organisation should make reasonable efforts to clarify 
this when responding and also identify, where possible, the source of 
information. 


4 - information |For care leavers this is often frustrating, especially if the organisation 
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relating to the 
individual and 
another person 


takes a restrictive or unimaginative approach regarding getting 
consent: in our experience too often it decides not to seek third party 
consent. This is compounded if the the Data Controller then exercises 
their discretion to share without consent in a narrow or negative way, 
adverse to the rights of the adult care leaver. It would be helpful in the 
later section at p39 if there were examples of the ‘balancing test’ for 
sharing all the information in such circumstances as redaction may 
render the quality or ‘sense’ of the relevant information meaningless or, 
at its worse, misleading. 


7 — preparation 
for SARs 


The bullets/actions are welcome, particularly the emphasis on an 
Assets Register, Training and Retention policies. Regarding retention it 
would be useful to include a reminder that in some circumstances [eg 
care records] there is a statutory time limit for retention of records 
which ‘reshapes’ the principle to hold data only as long as is necessary. 
An Assets Register is very important especially for older care leavers 
where their care records may have been transferred from another 
agency or carelessly archived, so this is an important message to 
Councillors, Ofsted and Directors of Children’s Services. See above our 
point about wider dissemination of the guidance. Where records were 
made in the 1960s and 70s or earlier many LAs have poor retention 
and retrieval systems as the IICSA has demonstrated. This has a 
profoundly adverse impact on the well-being of an adult care leaver 
making a SAR. 


9 — the individual 
does not have to 
say why and 
what they intend 
to do with the 
PD 


This is very welcome. In ACRCG’s experience and also that of CLA and 
other support groups, if the LA is fearful that the reason for the request 
is to seek redress or an apology or litigation, the preparation of their 
response is overseen and possibly managed by their public indemnity 
insurers. This reinforces practice which is restrictive, defensive and 
unhelpful leading to unnecessary redactions, delays and distress for 
the individual exercising their fundamental right. 


12 — SAR made 
through 3” party 
portal 


The voluntary sector and individuals have an important role in assisting 
adult care leavers to make a SAR. It is important that guidance states 
that the organisation should set out in its SAR policies what evidence 
from the third party [supporter] will satisfy the ID requirements. If this is 
unduly complicated, the individual making the SAR feels under 
pressure to not use a third party to support them through the process. 


lines to respond 


13 — child’s This is helpful as children in care may also want to see the PD held 
rights about them on health or education files, as well as care files. 
16- 18 -time |The guidance is clear about timelines: we welcome the statement that a 


request is not complex solely because the individual has requested a 
large amount of information. This is, too often, used as a reason to 
delay responding. It would be helpful to expand this section to give an 
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example to show that if there is a lot of PD material held, agreement 
can be made to release material in sections. Good practice is to work 
with the individual to find a way to do this effectively without putting 
them under pressure to say what they want first or to try and restrict 
what is shared, especially if they do not Know what personal data 
material is held. 


19 — person with 
disabilities 


For care leavers, undertaking a SAR requires courage and resilience 
and, whilst they may not have an identifiable disability, the emotional 
and mental stress may be considerable. This section could be 
expanded to include examples of providing suitable emotional support 
if that is what the individual wants. The reality for many adult care 
leavers is that they are asking for records from an organisation with 
whom they may have had a troubling and dismissive experience of 
care. The organisation should be able to show that they have taken this 
into account, being sensitive to the individual’s needs, both practical 
and emotional. 


19 & 20 - ID 


Verification requirements, which we accept are necessary, may pose 
barriers for adult care leavers. It is important to stress flexibility, taking 
into account the circumstances of the individual. Some will not have a 
passport, may not have documents about their birth date or utility or 
other types of usual ID documents. Care leavers in prison may have 
difficulties in establishing ID and it is important that local authorities 
and similar organisations have clear policies and practices for staff 
working with SARs about flexibility in establishing ID. It is also 
important to understand the internal procedures within the prison estate 
regarding ID documents. 


P23 — retrieving 
PD 


Establishing a high expectation to retrieve the person’s PD is very 
helpful. 


25 — no 
technology 
exemption 


This is clear and helpful. It would be useful to add that some PD is 
subject to rules about its retention which should be covered in the 
organisation’s retention and backup policies. In the case of this PD, it is 
important that methods for backing up records, some of which may now 
be in a fragile state, are sustainable and accessible in the future and 
that currently generated e-documents have been assessed to have 
long term viability both for enduring and for means of accessing eg 
should not become ‘inaccessible’ through lack of data software or 
systems. Migrating data across systems must address the integrity and 
security of the systems used as part of the ‘fit for purpose’ data 
migration methodology. 


25 — deleted 
information 


It would be useful to state that care records [and similar] cannot be 
deleted and that retention and storage policies must be clear. The 
retention period varies across the 4 nations and local authorities should 
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be encouraged retain such records beyond the prescribed date. This is 
an area where we think ICO could be influential when Ofsted create 
standards or expectations regarding archiving care records. 


28 - offence to 
amend/delete to 
avoid disclosure 


This is useful reminder. 


30 — methods for 
sharing 
information 


We welcome statement that the ‘..individual should not have 

to take action to receive the information (e.g. by collecting it from your 
premises) unless they agree to do so.’ The practice of how the files are 
‘shared’ varies widely across local authorities and is sometimes 
handled very insensitively. We endorse the clear statement that that the 
individual should not have to have the necessary software to ‘read’ the 
data. Some care leavers will not have access to either the software or 
the hardware to read e-documents and it is important that the onus to 
find an acceptable way to ‘access’ the information is on the 
organisation not the care leaver. 


33 — explaining 
information 
provided 


The principles are very helpful. For older care leavers language and 
terms used in care records may now read offensively and show 
disrespect for the individual and their family members. It is important to 
explain not only professional jargon or acronyms but also outdated 
terms which would now not be acceptable in professional records. We 
would welcome this section being extended to include a statement 
about this. 


35 — excessive 
and manifestly 
unfounded 


We welcome the case by case approach. This ‘reason’ for exempting 
sharing PD is open to wide and insensitive use. A adult care leaver may 
make several SARs at differing stages of their life journey as their 
personal circumstances alter; some will not be able to keep hold 
physically of their care records and will need to have that material a 
second or third time or more. This should not be interpreted as either 
unfounded or excessive. Hence, the circumstances of the individual 
when exercising their fundamental right need to be properly 
considered. It should not be used to avoid responding to the SAR or 
seeking to impose a fee. 


39 - 3" party PD: 
consent: 
exercise of 
discretion 


We welcome this section because this is particularly relevant to adult 
care leavers and our aim is to encourage Data Controllers to be more 
enabling in the way they exercise their discretion to share third party 
data. Practice about how and who makes decisions balancing the 
privacy rights of a third party and the fundamental rights of the 
individual varies within and across local authorities. Data governance 
officers may be less restrictive that social care professionals. This 
directly impacts on the rights of adult care leavers collectively and as 
individuals. Too often, it depends on the empathy of the particular data 
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governance officer dealing with the request or the social worker to 
persuade their managers, who are more concerned about the risk of a 
DPA breach, to overcome what becomes a pervasive culture of 
defensive ‘disclosure’ practice. 

Public indemnity Insurers also tend to create a defensive culture within 
the local authority. This particularly impacts on how discretion to share 
without consent or decisions about seeking consent are made. 
Frequently no one properly ascertains what 3" party PD is already 
known to the adult care leaver or partially known or is in the public 
arena. Thought is not given to how 3" party data can be shared without 
identifying an individual. 

It is helpful to state that refusal from the 3" party does not of itself 
remove the discretion to share and it would be helpful to set out in 
more detail or give an example of how to balance the care leaver’s 
Article 8 HRA right to family life and the 3" party's Article 8 right to 
privacy, making a decision which gives proper weight to the welfare and 
interests of the adult care leaver. It would be useful to include a 
statement that the ICO, responding to a 3 party complaint about data 
breach, will consider, taking account of all the circumstances, whether 
the exercise of discretion was ‘justifiable’ or provide an example of the 
approach by the ICO. 


41 - 
confidentiality 


The warning that there is no presumption of confidentiality merely 
because a document is so marked is useful. See our comments directly 
above. We would welcome an elaboration on how decision making is 
approached so that the decision made is ‘justifiable’ and is unlikely to 
be viewed as a breach of confidentiality. 

The example on p43 does not spell out the parameters for decision 
making about giving information about the family member. 


42 & 43 — 
health , social 
work and 
education data. 


The reminder that PD of professionals acting in their employed or 
professional capacity should be shared is useful. 


44 — relevant 
factors 


This is helpful and it would be useful if this section was linked with other 
sections about decision making. 


54 - exemptions 


‘Best interests’ is a vague concept, and in a culture where practice is 
defensive, it is likely to be interpreted narrowly and not in the interests 
of wider sharing of information. The needs and rights of the individual 
making the SAR should be at the centre of decision making about best 
interests. Sharing information with a parent or carer may place the 
individual at greater risk. 


64 — serious 
harm test and 


This section is useful, and it will be important for agencies and 
professionals to be accountable for decision making when applying the 
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exemption 


exemption so that it is not left to individual judgement which is likely to 
cause inconsistent approaches and reinforce poorly informed decision 
making. 


72 — social work 
data 


This section is helpful but may need more examples to improve 
practice and to ‘debunk’ myths about what is meant by social work data 
and social work functions. The statement at the end of p72 is clear but 
because decision making about sharing 3" party information is erratic 
and too often restrictive it would be useful to expand on the process in 
the relevant section of the guidance — see above. 


73 — expectation 
of confidence 


Inevitably this concept applies both ways and we try to encourage 
practitioners to think into the future about getting consent from family 
members/3rd parties to share information with a child or young person 
currently in care at some future point. This apparent lack of consent is 
often seen/used as a barrier to sharing in the case of a SAR from an 
older adult care leaver when such practice was not in place. The 
apparent lack of explicit consent is not put in context and is used as a 
reason not to exercise the discretion to give the 3" party information. 


74 — prejudice 
carrying out 
social work test 


This test or concept - the request would be likely to prejudice carrying 
out social work because it would be likely to cause serious harm to the 
physical or mental health of any individual — is not properly understood 
by social workers and their managers. It would be helpful to link back to 
the section on how the risk of ‘serious harm’ test needs to be properly 
evidence based by the judgement of a qualified health professional. 
The lack of support services for the individual making the SAR should 
not become a substantive reason for deciding that there is a risk of 
‘serious harm’ and decision making should be informed by clear 
guidelines and senior data governance decision making approval. It 
would be helpful if the detail regarding this was addressed in the 
guidance. 
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